src/danetool.c

   1 /*
   2  * Copyright (C) 2012 Free Software Foundation, Inc.
   3  *
   4  * This file is part of GnuTLS.
   5  *
   6  * GnuTLS is free software: you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation, either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * GnuTLS is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program.  If not, see
  18  * <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include <config.h>
  22
  23 #include <gnutls/gnutls.h>
  24 #include <gnutls/x509.h>
  25 #include <gnutls/openpgp.h>
  26 #include <gnutls/pkcs12.h>
  27 #include <gnutls/pkcs11.h>
  28 #include <gnutls/abstract.h>
  29 #include <gnutls/crypto.h>
  30 #include <gnutls/dane.h>
  31
  32 #include <stdio.h>
  33 #include <stdlib.h>
  34 #include <string.h>
  35 #include <ctype.h>
  36 #include <time.h>
  37 #include <unistd.h>
  38 #include <errno.h>
  39 #include <sys/types.h>
  40 #include <sys/stat.h>
  41 #include <fcntl.h>
  42 #include <error.h>
  43
  44 /* Gnulib portability files. */
  45 #include <read-file.h>
  46 #include <progname.h>
  47 #include <version-etc.h>
  48
  49 #include <common.h>
  50 #include "danetool-args.h"
  51 #include "certtool-common.h"
  52
  53 static void cmd_parser (int argc, char **argv);
  54 static void dane_info(const char* host, const char* proto, unsigned int port,
  55                       unsigned int ca, unsigned int local, common_info_st * cinfo);
  56
  57 static void dane_check(const char* host, const char* proto, unsigned int port,
  58                        common_info_st * cinfo);
  59
  60 FILE *outfile;
  61 static gnutls_digest_algorithm_t default_dig;
  62
  63 /* non interactive operation if set
  64  */
  65 int batch;
  66
  67
  68 static void
  69 tls_log_func (int level, const char *str)
  70 {
  71   fprintf (stderr, "|<%d>| %s", level, str);
  72 }
  73
  74 int
  75 main (int argc, char **argv)
  76 {
  77   set_program_name (argv[0]);
  78   cmd_parser (argc, argv);
  79
  80   return 0;
  81 }
  82
  83
  84 static void
  85 cmd_parser (int argc, char **argv)
  86 {
  87   int ret, privkey_op = 0;
  88   common_info_st cinfo;
  89   const char* proto = "tcp";
  90   unsigned int port = 443;
  91
  92   optionProcess( &danetoolOptions, argc, argv);
  93
  94   if (HAVE_OPT(OUTFILE))
  95     {
  96       outfile = safe_open_rw (OPT_ARG(OUTFILE), privkey_op);
  97       if (outfile == NULL)
  98         error (EXIT_FAILURE, errno, "%s", OPT_ARG(OUTFILE));
  99     }
 100   else
 101     outfile = stdout;
 102
 103   default_dig = GNUTLS_DIG_UNKNOWN;
 104   if (HAVE_OPT(HASH))
 105     {
 106       if (strcasecmp (OPT_ARG(HASH), "md5") == 0)
 107         {
 108           fprintf (stderr,
 109                    "Warning: MD5 is broken, and should not be used any more for digital signatures.\n");
 110           default_dig = GNUTLS_DIG_MD5;
 111         }
 112       else if (strcasecmp (OPT_ARG(HASH), "sha1") == 0)
 113         default_dig = GNUTLS_DIG_SHA1;
 114       else if (strcasecmp (OPT_ARG(HASH), "sha256") == 0)
 115         default_dig = GNUTLS_DIG_SHA256;
 116       else if (strcasecmp (OPT_ARG(HASH), "sha224") == 0)
 117         default_dig = GNUTLS_DIG_SHA224;
 118       else if (strcasecmp (OPT_ARG(HASH), "sha384") == 0)
 119         default_dig = GNUTLS_DIG_SHA384;
 120       else if (strcasecmp (OPT_ARG(HASH), "sha512") == 0)
 121         default_dig = GNUTLS_DIG_SHA512;
 122       else if (strcasecmp (OPT_ARG(HASH), "rmd160") == 0)
 123         default_dig = GNUTLS_DIG_RMD160;
 124       else
 125         error (EXIT_FAILURE, 0, "invalid hash: %s", OPT_ARG(HASH));
 126     }
 127
 128   gnutls_global_set_log_function (tls_log_func);
 129
 130   if (HAVE_OPT(DEBUG))
 131     {
 132       gnutls_global_set_log_level (OPT_VALUE_DEBUG);
 133       printf ("Setting log level to %d\n", (int)OPT_VALUE_DEBUG);
 134     }
 135
 136   if ((ret = gnutls_global_init ()) < 0)
 137     error (EXIT_FAILURE, 0, "global_init: %s", gnutls_strerror (ret));
 138
 139 #ifdef ENABLE_PKCS11
 140   pkcs11_common();
 141 #endif
 142
 143   memset (&cinfo, 0, sizeof (cinfo));
 144
 145   if (HAVE_OPT(INDER) || HAVE_OPT(INRAW))
 146     cinfo.incert_format = GNUTLS_X509_FMT_DER;
 147   else
 148     cinfo.incert_format = GNUTLS_X509_FMT_PEM;
 149
 150   if (HAVE_OPT(VERBOSE))
 151     cinfo.verbose = 1;
 152
 153   if (HAVE_OPT(LOAD_PUBKEY))
 154     cinfo.pubkey = OPT_ARG(LOAD_PUBKEY);
 155
 156   if (HAVE_OPT(LOAD_CERTIFICATE))
 157     cinfo.cert = OPT_ARG(LOAD_CERTIFICATE);
 158
 159   if (HAVE_OPT(PORT))
 160     port = OPT_VALUE_PORT;
 161   if (HAVE_OPT(PROTO))
 162     proto = OPT_ARG(PROTO);
 163
 164   if (HAVE_OPT(TLSA_RR))
 165     dane_info (OPT_ARG(HOST), proto, port,
 166                HAVE_OPT(CA), HAVE_OPT(LOCAL), &cinfo);
 167   else if (HAVE_OPT(CHECK))
 168     dane_check (OPT_ARG(CHECK), proto, port,
 169                 &cinfo);
 170   else
 171     USAGE(1);
 172
 173   fclose (outfile);
 174
 175 #ifdef ENABLE_PKCS11
 176   gnutls_pkcs11_deinit ();
 177 #endif
 178   gnutls_global_deinit ();
 179 }
 180
 181 static void dane_check(const char* host, const char* proto, unsigned int port,
 182                        common_info_st * cinfo)
 183 {
 184 dane_state_t s;
 185 dane_query_t q;
 186 int ret;
 187 unsigned int flags = DANE_F_IGNORE_LOCAL_RESOLVER, i;
 188 unsigned int usage, type, match;
 189 gnutls_datum_t data, file;
 190 size_t size;
 191
 192   if (ENABLED_OPT(LOCAL_DNS))
 193     flags = 0;
 194
 195   printf("Querying on %s (%s:%d)...\n", host, proto, port);
 196   ret = dane_state_init(&s, flags);
 197   if (ret < 0)
 198     error (EXIT_FAILURE, 0, "dane_state_init: %s", dane_strerror (ret));
 199
 200   ret = dane_query_tlsa(s, &q, host, proto, port);
 201   if (ret < 0)
 202     error (EXIT_FAILURE, 0, "dane_query_tlsa: %s", dane_strerror (ret));
 203
 204   for (i=0;i<dane_query_entries(q);i++)
 205     {
 206       ret = dane_query_data(q, i, &usage, &type, &match, &data);
 207       if (ret < 0)
 208         error (EXIT_FAILURE, 0, "dane_query_data: %s", dane_strerror (ret));
 209
 210
 211       size = buffer_size;
 212       ret = gnutls_hex_encode(&data, (void*)buffer, &size);
 213       if (ret < 0)
 214         error (EXIT_FAILURE, 0, "gnutls_hex_encode: %s", dane_strerror (ret));
 215
 216       printf("\nEntry %d:\n", i+1);
 217       fprintf(outfile, "_%u._%s.%s. IN TLSA ( %.2x %.2x %.2x %s )\n", port, proto, host, usage, type, match, buffer);
 218
 219       printf("\nCertificate usage: %s\n", dane_cert_usage_name(usage));
 220       printf("Certificate type: %s\n", dane_cert_type_name(type));
 221       printf("Contents: %s\n", dane_match_type_name(match));
 222       printf("Data: %s\n", buffer);
 223
 224       /* Verify the DANE data */
 225       if (cinfo->cert)
 226         {
 227           gnutls_x509_crt_t *clist;
 228           unsigned int clist_size, status;
 229
 230           ret = gnutls_load_file(cinfo->cert, &file);
 231           if (ret < 0)
 232             error (EXIT_FAILURE, 0, "gnutls_load_file: %s", gnutls_strerror (ret));
 233
 234           ret = gnutls_x509_crt_list_import2( &clist, &clist_size, &file, cinfo->incert_format, 0);
 235           if (ret < 0)
 236             error (EXIT_FAILURE, 0, "gnutls_x509_crt_list_import2: %s", gnutls_strerror (ret));
 237
 238           if (clist_size > 0)
 239             {
 240               gnutls_datum_t certs[clist_size];
 241               gnutls_datum_t out;
 242               unsigned int i;
 243
 244               for (i=0;i<clist_size;i++)
 245                 {
 246                   ret = gnutls_x509_crt_export2( clist[i], GNUTLS_X509_FMT_DER, &certs[i]);
 247                   if (ret < 0)
 248                     error (EXIT_FAILURE, 0, "gnutls_x509_crt_export2: %s", gnutls_strerror (ret));
 249                 }
 250
 251               ret = dane_verify_crt( s, certs, clist_size, GNUTLS_CRT_X509,
 252                                      host, proto, port, 0, 0, &status);
 253               if (ret < 0)
 254                 error (EXIT_FAILURE, 0, "dane_verify_crt: %s", dane_strerror (ret));
 255
 256               ret = dane_verification_status_print(status, &out, 0);
 257               if (ret < 0)
 258                 error (EXIT_FAILURE, 0, "dane_verification_status_print: %s", dane_strerror (ret));
 259
 260               printf("\nVerification: %s\n", out.data);
 261               gnutls_free(out.data);
 262
 263               for (i=0;i<clist_size;i++)
 264                 {
 265                   gnutls_free(certs[i].data);
 266                   gnutls_x509_crt_deinit(clist[i]);
 267                 }
 268               gnutls_free(clist);
 269             }
 270         }
 271     }
 272
 273
 274   dane_query_deinit(q);
 275   dane_state_deinit(s);
 276
 277 }
 278
 279 static void dane_info(const char* host, const char* proto, unsigned int port,
 280                       unsigned int ca, unsigned int local, common_info_st * cinfo)
 281 {
 282   gnutls_pubkey_t pubkey;
 283   gnutls_x509_crt_t crt;
 284   unsigned char digest[64];
 285   gnutls_datum_t t;
 286   int ret;
 287   unsigned int usage, selector, type;
 288   size_t size;
 289
 290   if (proto == NULL)
 291     proto = "tcp";
 292   if (port == 0)
 293     port = 443;
 294
 295   crt = load_cert (0, cinfo);
 296   if (crt != NULL && HAVE_OPT(X509))
 297     {
 298       selector = 0; /* X.509 */
 299
 300       size = buffer_size;
 301       ret = gnutls_x509_crt_export (crt, GNUTLS_X509_FMT_DER, buffer, &size);
 302       if (ret < 0)
 303         error (EXIT_FAILURE, 0, "export error: %s", gnutls_strerror (ret));
 304
 305       gnutls_x509_crt_deinit (crt);
 306     }
 307   else /* use public key only */
 308     {
 309       selector = 1;
 310
 311       ret = gnutls_pubkey_init (&pubkey);
 312       if (ret < 0)
 313         error (EXIT_FAILURE, 0, "pubkey_init: %s", gnutls_strerror (ret));
 314
 315       if (crt != NULL)
 316         {
 317
 318           ret = gnutls_pubkey_import_x509 (pubkey, crt, 0);
 319           if (ret < 0)
 320             {
 321               error (EXIT_FAILURE, 0, "pubkey_import_x509: %s",
 322                      gnutls_strerror (ret));
 323             }
 324
 325           size = buffer_size;
 326           ret = gnutls_pubkey_export (pubkey, GNUTLS_X509_FMT_DER, buffer, &size);
 327           if (ret < 0)
 328             {
 329               error (EXIT_FAILURE, 0, "pubkey_export: %s",
 330                      gnutls_strerror (ret));
 331             }
 332
 333           gnutls_x509_crt_deinit(crt);
 334         }
 335       else
 336         {
 337           pubkey = load_pubkey (1, cinfo);
 338
 339           size = buffer_size;
 340           ret = gnutls_pubkey_export (pubkey, GNUTLS_X509_FMT_DER, buffer, &size);
 341           if (ret < 0)
 342             error (EXIT_FAILURE, 0, "export error: %s", gnutls_strerror (ret));
 343         }
 344
 345       gnutls_pubkey_deinit (pubkey);
 346     }
 347
 348   if (default_dig != GNUTLS_DIG_SHA256 && default_dig != GNUTLS_DIG_SHA512)
 349     {
 350       if (default_dig != GNUTLS_DIG_UNKNOWN) fprintf(stderr, "Unsupported digest. Assuming SHA256.\n");
 351       default_dig = GNUTLS_DIG_SHA256;
 352     }
 353
 354   ret = gnutls_hash_fast(default_dig, buffer, size, digest);
 355   if (ret < 0)
 356     error (EXIT_FAILURE, 0, "hash error: %s", gnutls_strerror (ret));
 357
 358   if (default_dig == GNUTLS_DIG_SHA256)
 359     type = 1;
 360   else type = 2;
 361
 362   /* DANE certificate classification crap */
 363   if (local==0)
 364     {
 365       if (ca) usage = 0;
 366       else usage = 1;
 367     }
 368   else
 369     {
 370       if (ca) usage = 2;
 371       else usage = 3;
 372     }
 373
 374   t.data = digest;
 375   t.size = gnutls_hash_get_len(default_dig);
 376
 377   size = buffer_size;
 378   ret = gnutls_hex_encode(&t, (void*)buffer, &size);
 379   if (ret < 0)
 380     error (EXIT_FAILURE, 0, "hex encode error: %s", gnutls_strerror (ret));
 381
 382   fprintf(outfile, "_%u._%s.%s. IN TLSA ( %.2x %.2x %.2x %s )\n", port, proto, host, usage, selector, type, buffer);
 383
 384 }